> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tight.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Request Access Token

> Exchange client credentials for a bearer access token



## OpenAPI

````yaml openapi-oauth.yaml POST /v6/auth/token
openapi: 3.1.0
info:
  title: Tight OAuth API
  description: OAuth 2.0 endpoints for the Tight API
  version: 6.0.0
servers:
  - url: https://sandbox.tight.com
    description: Sandbox
  - url: https://prod.tight.com
    description: Production
security: []
paths:
  /v6/auth/token:
    post:
      tags:
        - OAuth
      summary: Request access token
      description: >
        Exchange client credentials (and optionally a `userId`) for an access
        token.


        Supports `authorization_code`, `client_credentials`, and `refresh_token`
        grant types.

        Authenticate using HTTP Basic auth
      operationId: postToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  enum:
                    - client_credentials
                    - authorization_code
                    - refresh_token
                  description: >-
                    The OAuth 2.0 grant type to use. Defaults to
                    `client_credentials`
                userId:
                  type: string
                  description: >
                    The Tight user ID to generate a scoped token for. Omit to
                    generate a partner-level token with access to all companies.
                apiCompanyId:
                  type: string
                  description: >
                    Scopes a bookkeeper's token to a single company. Provide the
                    `userId` of a bookkeeper together with the `apiCompanyId` of
                    a company they can access to generate a token that acts as
                    that bookkeeper working on behalf of that specific company.
                    Requires `userId` to be the ID of a bookkeeper.
                code:
                  type: string
                  description: >-
                    The authorization code received from the authorization
                    endpoint. Required for `authorization_code` grant type.
                redirect_uri:
                  type: string
                  description: >-
                    The redirect URI used in the authorization request. Required
                    for `authorization_code` grant type.
                code_verifier:
                  type: string
                  description: >-
                    The PKCE code verifier. Required when
                    `code_challenge_method=S256` was used in the authorization
                    request.
                refresh_token:
                  type: string
                  description: >-
                    The refresh token to exchange for a new access token.
                    Required for `refresh_token` grant type.
                scope:
                  type: string
                  enum:
                    - read
                    - write
                  description: >
                    Limits the token's permissions. Use `read` to create a
                    read-only token,

                    or `write` to allow write access. Defaults to `write` if
                    omitted.
            examples:
              client_credentials_user:
                summary: Business owner token
                value:
                  grant_type: client_credentials
                  userId: your_userId
              client_credentials_partner:
                summary: Partner-level token
                value:
                  grant_type: client_credentials
              client_credentials_bookkeeper_company:
                summary: Bookkeeper token scoped to a company
                value:
                  grant_type: client_credentials
                  userId: bookkeeper_userId
                  apiCompanyId: company_userId
              client_credentials_read_only:
                summary: Read-only business owner token
                value:
                  grant_type: client_credentials
                  userId: your_userId
                  scope: read
              authorization_code:
                summary: Authorization code exchange
                value:
                  grant_type: authorization_code
                  code: SplxlOBeZQQYbYS6WxSbIA
                  redirect_uri: https://yourapp.com/callback
                  code_verifier: dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
              refresh_token:
                summary: Refresh token exchange
                value:
                  grant_type: refresh_token
                  refresh_token: tGzv3JOkF0XG5Qx2TlKWIA
      responses:
        '200':
          description: Access token issued successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                    description: The bearer token to include in API requests.
                    example: eyJhbGciOiJSUzI1NiJ9...
                  token_type:
                    type: string
                    enum:
                      - Bearer
                    example: Bearer
                  expires_in:
                    type: integer
                    description: Token lifetime in seconds.
                    example: 3600
                  refresh_token:
                    type: string
                    description: >-
                      Refresh token, returned for `authorization_code` grant
                      types.
                    example: tGzv3JOkF0XG5Qx2TlKWIA
                  scope:
                    type: string
                    description: Space-separated list of granted scopes, if applicable.
      security:
        - basicAuth: []
        - {}
components:
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
      description: HTTP Basic authentication using `client_id:client_secret`

````